1174     const uint8_t payload_offset = 3 + length_offset + credit_offset;  in rfcomm_multiplexer_l2cap_packet_handler()  local
1210             if (payload_offset >= size) return 0;  in rfcomm_multiplexer_l2cap_packet_handler()
1212             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){  in rfcomm_multiplexer_l2cap_packet_handler()
1220             switch (packet[payload_offset]){  in rfcomm_multiplexer_l2cap_packet_handler()
1240                     if ((payload_offset + 1) >= size) return 0; // (1)  in rfcomm_multiplexer_l2cap_packet_handler()
1242                     int len = packet[payload_offset+1] >> 1; // length < 125  in rfcomm_multiplexer_l2cap_packet_handler()
1247                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak  in rfcomm_multiplexer_l2cap_packet_handler()
1250                                  &packet[payload_offset + 2], len);  in rfcomm_multiplexer_l2cap_packet_handler()
1390     const uint8_t payload_offset = 3 + length_offset + credit_offset;  in rfcomm_channel_packet_handler_uih()  local
1417     if ((size - 1) > payload_offset){  in rfcomm_channel_packet_handler_uih()
1428                               &packet[payload_offset], size-payload_offset-1);  in rfcomm_channel_packet_handler_uih()
1544     const uint8_t payload_offset = 3 + length_offset + credit_offset;  in rfcomm_channel_packet_handler()  local
1588             message_len  = packet[payload_offset+1] >> 1;  in rfcomm_channel_packet_handler()
1590             switch (packet[payload_offset]) {  in rfcomm_channel_packet_handler()
1592                     message_dlci = packet[payload_offset+2];  in rfcomm_channel_packet_handler()
1594                     event_pn.priority = packet[payload_offset+4];  in rfcomm_channel_packet_handler()
1595                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);  in rfcomm_channel_packet_handler()
1596                     event_pn.credits_outgoing = packet[payload_offset+9];  in rfcomm_channel_packet_handler()
1603                     message_dlci = packet[payload_offset+2];  in rfcomm_channel_packet_handler()
1605                     event_pn.priority = packet[payload_offset+4];  in rfcomm_channel_packet_handler()
1606                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);  in rfcomm_channel_packet_handler()
1607                     event_pn.credits_outgoing = packet[payload_offset+9];  in rfcomm_channel_packet_handler()
1614                     message_dlci = packet[payload_offset+2] >> 2;  in rfcomm_channel_packet_handler()
1616                     event_msc.modem_status = packet[payload_offset+3];  in rfcomm_channel_packet_handler()
1622                     message_dlci = packet[payload_offset+2] >> 2;  in rfcomm_channel_packet_handler()
1629                     message_dlci = packet[payload_offset+2] >> 2;  in rfcomm_channel_packet_handler()
1639                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];  in rfcomm_channel_packet_handler()
1648                     message_dlci = packet[payload_offset+2] >> 2;  in rfcomm_channel_packet_handler()
1651                     event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];  in rfcomm_channel_packet_handler()
1657                     message_dlci = packet[payload_offset+2] >> 2;  in rfcomm_channel_packet_handler()
1660                     event_rls.line_status = packet[payload_offset+3];  in rfcomm_channel_packet_handler()
1675 …                log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);   in rfcomm_channel_packet_handler()
1676                     multiplexer->nsc_command = packet[payload_offset];  in rfcomm_channel_packet_handler()